OLA 



OFFICE OF THE LEGISLATIVE AUDITOR 

State of Minnesota 



Financial Audit Division Report 

Metropolitan State University 

Internal Controls and Compliance Audit 
July 2008, through March 31, 2011 



January 17, 2012 Report 12-01 

FINANCIAL AUDIT DIVISION 

Centennial Building - Suite 140 

658 Cedar Street - Saint Paul, MN 55155 

Telephone: 651-296-4708 • Fax: 651-296-4712 

E-mail: auditor@state.mn.us • Website: http://www.auditor.leg.state.mn.us 
Through Minnesota Relay: 1-800-627-3529 or 7-1-1 



o 



L 



A 



Office of the Legislative Auditor 

State of Minnesota • James Nobles, Legislative Auditor 



January 17, 2012 

Representative Michael Beard, Chair 
Legislative Audit Commission 

Members of the Legislative Audit Commission 

Dr. Steven J. Rosenstone, Chancellor 
Minnesota State Colleges and Universities 

Board of Trustees 

Minnesota State Colleges and Universities 

Dr. Sue K. Hammersmith, President 
Metropolitan State University 



This report presents the results of our internal controls and compliance audit of Metropolitan 
State University for the period July 1, 2008, through March 31, 201 1. 

We discussed the results of the audit with Metropolitan State University on January 11, 2012. 
The audit was conducted by David Poliseno, CPA, CISA, CFE (Audit Manager) and Carl Otto, 
CPA, CISA (Auditor-in-Charge), assisted by auditors Kathy Rootham, Emily Wiant, Kevin 
Schoenrock, and Carissa Moritz. 

This report is intended for the information and use of the Legislative Audit Commission and the 
management and board of the Minnesota State Colleges and Universities and Metropolitan State 
University. This restriction is not intended to limit the distribution of this report, which was 
released as a public document on January 17, 2012. 

We received the full cooperation of Metropolitan State University's staff while performing this 
audit. 



Room 140 Centennial Building, 658 Cedar Street, St. Paul, Minnesota 55155-1603 * Tel: 651-296-4708 * Fax: 651-296-4712 
E-mail: auditor@state.mn.us • Web Site: www.auditor.leg.state.mn.us • Through Minnesota Relay: 1-800-627-3529 or 7-1-1 





James R. Nobles 
Legislative Auditor 



Cecile M. Ferkul, CPA, CISA 
Deputy Legislative Auditor 



Metropolitan State University 



Table of Contents 

Page 



Report Summary 1 

Overview 3 

Objective, Scope, and Methodology 4 

Conclusion 6 

Findings and Recommendations 7 

1 . Prior Systemic Finding Not Resolved: Metropolitan State University 
did not adequately assess its business risks or monitor the 
effectiveness of its internal controls 7 

2. Metropolitan State University did not design, document, or monitor 
internal controls to mitigate risks created by some key employees 
having incompatible access to computer system functions. The 
university also did not resolve a prior audit finding when it allowed its 
cashiers to share logon IDs 8 

3. Metropolitan State University charged some students tuition rates and 
fees that were different from the amounts approved by the MnSCU 
Board of Trustees 9 

4. Prior Systemic Finding Not Resolved: Metropolitan State University 
did not always accurately account for faculty and administrator leave 
benefits 11 

5. Metropolitan State University inaccurately compensated some 
employees 12 

6. Prior Finding Partially Resolved: Metropolitan State University did 

not verify the accuracy of its bookstore commission receipts 13 

7. Metropolitan State University did not always retain adequate 
documentation to support its personnel and payroll actions 13 

8. Prior Systemic Finding Partially Resolved: Metropolitan State 
University did not sufficiently control employees' use of university- 
issued purchasing cards 14 



Metropolitan State University 



Page 

9. Metropolitan State University did not properly delegate authority to 
some of its employees to authorize contracts, purchase goods or 



services, and approve invoices for payment 15 

10. Metropolitan State University did not properly process graduate 
assistant payroll transactions 16 

1 1 . Metropolitan State University did not always properly process student 
tuition waivers 17 

12. Metropolitan State University did not accurately refund tuition and 

fees to certain students 17 

Agency Response 19 



Minnesota Office of the Legislative Auditor 



1 



Report Summary 

Conclusion 

Metropolitan State University generally had adequate internal controls over its 
major financial activities, such as tuition and fees, employee salaries, and 
operating expenses. 1 These controls generally ensured that the university 
safeguarded assets, accurately paid employees and vendors in accordance with 
management's authorization, produced reliable financial information, and 
complied with finance-related legal requirements. However, the university had 
some control weaknesses and noncompliance in certain areas that have a high-risk 
for errors, including security access to financial systems. 

For the items tested, Metropolitan State University did not comply with some 
policies and legal provisions related to purchasing cards, delegation of authority, 
procurement, tuition and fee rates, and leave benefits. 

Metropolitan State University resolved 1 of the 3 prior audit findings. The 
university did not fully resolve prior audit Finding 2 related to its verification of 
commission reports for bookstore operations; we repeat this finding as Finding 6. 
The university also did not fully resolve prior audit Finding 3 related to the 
sharing of cashiering activities; we repeat this finding as Finding 2. In addition, 
the university had three findings (Findings 1, 4, and 8) in areas where prior audits 
of other colleges and universities had identified common or systemic findings. 3 

Key Findings 

• Prior Systemic Finding Not Resolved: Metropolitan State University did not 
adequately assess its business risks or monitor the effectiveness of its internal 
controls. (Finding 1, page 7) 

• Metropolitan State University did not design, document, or monitor internal 
controls to mitigate risks created by some key employees having incompatible 
access to computer system functions. The university also did not resolve a 
prior audit finding when it allowed its cashiers to share logon IDs. (Finding 2, 
page 8) 



1 The audit scope did not include student financial aid. 

2 Minnesota Office of the Legislative Auditor, Financial Audit Division Report 02-58, 
Metropolitan State University, issued September 6, 2002. The report contained three findings. 

3 Minnesota Office of the Legislative Auditor, Financial Audit Division Report 10-29, Minnesota 
State Colleges and Universities, issued September 14, 2010. This report contained six systemic 
findings, which we define as an internal control or compliance weakness noted at a majority of 
colleges or universities that we believe can most effectively be resolved by directive, guidance, or 
oversight by the MnSCU system office. 



2 



Metropolitan State University 



• Metropolitan State University charged some students tuition rates and fees 
that were different from the amounts approved by the MnSCU Board of 
Trustees. (Finding 3, page 9) 

• Prior Systemic Finding Not Resolved: 4 Metropolitan State University did not 
always accurately account for faculty and administrator leave benefits. 
(Finding 4, page 11) 



Audit Objectives and Scope 

Objectives 

• Internal Controls 

• Compliance 
Programs Audited 

• Financial systems security access 

• Tuition and fee revenues 

• Auxiliary revenues 

• Local bank accounts 



Period Audited 

July 1, 2008, through March 31, 201 1 

• Personnel and payroll expenses 

• Operating expenses 

• Equipment purchases 

• Relationship with the Metropolitan 
State University Foundation 



4 Minnesota Office of the Legislative Auditor, Financial Audit Division, Report 10-29, Minnesota 
State Colleges and Universities, issued September 14, 2010 (Finding 4). 
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Metropolitan State University 
Overview 

Metropolitan State University serves over 9,600 students. Approximately 36 
percent of the students are full-time and 64 percent are part-time. The university 
offers more than 60 undergraduate majors and a variety of graduate programs. 
Dr. Sue K. Hammersmith has been the president of the university since July 2008. 
The university is part of the Minnesota State Colleges and Universities (MnSCU) 
system. MnSCU is comprised of 31 state universities, community colleges, 
technical colleges, and the system office. The MnSCU Board of Trustees appoints 
the chancellor and provides strategic direction and governance for the system. 5 

Metropolitan State University uses MnSCU' s accounting system to process and 
record financial activities. It uses the MnSCU accounting system to generate 
payments from the state treasury and account for money maintained outside of the 
state treasury in local bank accounts. Metropolitan State University uses local 
bank accounts to allow for greater flexibility in managing high-volume 
transactions for financial aid, student activities, and auxiliary operations, such as 
parking and food service. 

Metropolitan State University finances its operations through the Office of the 
Chancellor's allocation of state appropriation and retention of its tuition and other 
receipts. These revenues determine the university's total authorized spending 
level. The authorized spending level is the basis for establishing spending budgets 
for various administrative functions and academic departments. The university's 
yearly audited financial statements provide additional information on the 
university's financial operations. 6 

Table 1 summarizes the university's financial activities for fiscal years 2009 and 
2010. 



5 Minnesota Statutes 2010, 136F.06 and 136F.07. 

6 Metropolitan State University audited financial statements can be found at MnSCU' s web site 
under the Finance Division. 
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Table 1 

Revenues, Expenses, and Changes in Net Assets 
Fiscal Years 2009 and 2010 (In Thousands) 

2009 2010 

Revenues 

Tuition, auxiliary and sales, net $ 24,748 $ 27,496 

State appropriations 24,128 21,987 

Capital appropriations 689 9,017 

Other 11,933 17,725 

Total Revenue $ 61.498 $ 76.225 

Expenses 

Salaries and benefits $ 42,816 $ 43,615 

Services and other expenses 1 3,799 1 5,835 

Depreciation 2,306 2,299 

Financial aid, net 1 ,126 2,092 

Interest expense 539 623 

Other 39 48 

Total Expense $ 60.625 $ 64.512 

Change in net assets $ 873 $11,713 

Total net assets, beginning of year $ 45,361 $ 46,234 

Net assets, end of year $ 46,234 $ 57,947 

Source: Metropolitan State University's Annual Financial Report for the years ended June 30, 2009 and 2010, 
Management's Discussion and Analysis. 



Objective, Scope, and Methodology 

Our audit included the material financial activities of Metropolitan State 
University, including security over access to computerized accounting 
applications, tuition and fee revenues, auxiliary revenues, 7 local bank accounts, 
personnel and payroll expenses, operating and administrative expenses, 
equipment purchases, and the university's relationship with the Metropolitan State 
University Foundation. However, the scope did not include federal student 
financial aid. 8 The audit examined transactions for fiscal years 2009, 2010, and 
201 l(through March 31, 201 1). 

Our audit objective was to answer the following questions: 

• Were internal controls at Metropolitan State University adequate to ensure 
that the university safeguarded receipts and other assets, accurately paid 
employees and vendors in accordance with management's authorization, 



Auxiliary revenue activities include parking, food service and vending, and bookstore operations. 
8 Because federal student financial aid is audited by a CPA firm under the Single Audit Act, we 
did not include student financial aid in our audit scope. 
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produced reliable financial information, and complied with finance-related 
legal requirements? 

• For the items tested, did Metropolitan State University comply with 
significant finance-related legal requirements over financial activities, 
including state laws, regulations, contracts, and applicable policies and 
procedures? 

• Did Metropolitan State University resolve prior audit findings, 9 including 
those findings identified as MnSCU systemic findings in audits of other 
colleges? 10 

To answer these questions, we interviewed the university's staff to gain an 
understanding of the controls related to Metropolitan State University's financial 
operations. In determining our audit approach, we considered the risk of errors in 
the accounting records and potential noncompliance with finance-related legal 
requirements. We also analyzed accounting data to identify unusual transactions 
or significant changes in financial operations for further review. In addition, we 
selected a sample of financial transactions and reviewed supporting 
documentation to test whether the university's controls were effective and if the 
transactions complied with laws, regulations, policies, and grant and contract 
provisions. 

We conducted the audit in accordance with generally accepted government 
auditing standards. Those standards require that we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objective. 

We used various criteria to evaluate internal control and compliance. We used, as 
our criteria to evaluate the university's controls, the guidance contained in the 
Internal Control-Integrated Framework, published by the Committee of 
Sponsoring Organizations of the Treadway Commission. 11 We used state and 
federal laws, regulations, and contracts, as well as policies and procedures 
established by the Department of Management and Budget and MnSCU' s internal 
policies and procedures as evaluation criteria for compliance. 



9 Minnesota Office of the Legislative Auditor, Financial Audit Division Report 02-58, 
Metropolitan State University, issued September 6, 2002. The report contained three findings. 

10 Minnesota Office of the Legislative Auditor, Financial Audit Division Report 10-29, Minnesota 
State Colleges and Universities, issued September 14, 2010. This report contained six systemic 
findings, which we define as an internal control or compliance weakness noted at a majority of 
colleges or universities that we believe can most effectively be resolved by directive, guidance, or 
oversight by the MnSCU system office. 

1 1 The Treadway Commission and its Committee of Sponsoring Organizations were established in 
1985 by the major national associations of accountants. One of their primary tasks was to identify 
the components of internal control that organizations should have in place to prevent inappropriate 
financial activity. The resulting Internal Control-Integrated Framework is the accepted accounting 
and auditing standard for internal control design and assessment. 
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Conclusion 

Metropolitan State University generally had adequate internal controls over its 
major financial activities, such as tuition and fees, employee salaries, and 
operating expenses. These controls generally ensured that the university 
safeguarded assets, accurately paid employees and vendors in accordance with 
management's authorization, produced reliable financial information, and 
complied with finance-related legal requirements. However, the university had 
some control weaknesses and noncompliance in certain areas that have a high-risk 
for errors, including security access to financial systems. 

For the items tested, Metropolitan State University did not comply with some 
legal provisions and MnSCU and university policies, including those related to 
delegation of authority, tuition and fee rates, and leave benefits. 

Metropolitan State University resolved 1 of the 3 prior audit findings relevant to 

12 

this audit. However, the university did not fully resolve prior audit Finding 2 
related to its verification of commission reports for bookstore operations. We 
repeat this finding as Finding 6. The university also did not fully resolve prior 
audit Finding 3 related to the sharing of cashiering activities. We repeat this 
finding as Finding 2. In addition, the university had three findings (Findings 1, 4, 
and 8) in areas where prior audits of other colleges and universities had identified 

1 3 

common or systemic findings. 

The following Findings and Recommendations section of the report identifies the 
internal control weaknesses and noncompliance concerns. 



Minnesota Office of the Legislative Auditor, Financial Audit Division Report 02-58, 
Metropolitan State University, issued September 6, 2002. The report contained three findings. 
13 Minnesota Office of the Legislative Auditor, Financial Audit Division Report 10-29, Minnesota 
State Colleges and Universities, issued September 14, 2010. This report contained six systemic 
findings, which we define as an internal control or compliance weakness noted at a majority of 
colleges or universities that we believe can most effectively be resolved by directive, guidance, or 
oversight by the MnSCU system office. 
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Findings and Recommendations 



Prior Systemic Finding Not Resolved: 14 Metropolitan State University did Finding 1 
not adequately assess its business risks or monitor the effectiveness of its 
internal controls. 



The university did not effectively assess its risks related to important operational 
and finance-related legal compliance areas, including tuition and fee revenues, 
auxiliary revenues, personnel and payroll expenses, operating and administrative 
expenses, equipment purchases, and inventory. Further, the university did not 
have a comprehensive plan to monitor the effectiveness of its internal controls. 

Metropolitan State University had documented its risks and internal controls over 
a number of financial cycles related to financial reporting. However, it did not 
extend its risk assessment to include other important risks associated with its 
operational and compliance responsibilities. The university was aware of certain 
risks, had many control activities in place, and performed selected internal control 
monitoring functions. 

A comprehensive control structure has the following key elements: 

• Personnel are trained and knowledgeable about finance-related legal 
provisions and applicable policies and procedures. 

• Management identifies risks associated with finance-related legal 
provisions and develops policies and procedures to effectively address the 
identified risks. 



• Management continuously monitors the effectiveness of the controls, 
identifies weaknesses and breakdowns in controls, and takes corrective 
action. 



• Management focuses on continual improvement to ensure an acceptable 
balance between controls and costs. 



Findings 2 through 12 identify deficiencies in the university's internal control 
procedures and specific noncompliance with finance-related legal requirements 
that were not prevented or detected by the university's internal control structure. 



Minnesota Office of the Legislative Auditor, Financial Audit Division, Report 10-29, Minnesota 
State Colleges and Universities, issued September 14, 2010 (Finding 1). (We define a systemic 
finding as an internal control or compliance weakness noted at a majority of colleges or 
universities that we believe can most effectively be resolved by directive, guidance, or oversight 
by the MnSCU system office.) 
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These deficiencies created a risk of error or noncompliance not being prevented or 
detected. It is likely that the university will continue to have noncompliance and 
weaknesses in internal controls until it operates within a comprehensive internal 
control structure that includes operational and compliance risks in addition to 
financial reporting risks. 

Recommendation 

• The university should clearly document and frequently review 
its risks, internal control activities, and monitoring functions 
related to its operational and compliance responsibilities. 

Metropolitan State University did not design, document, or monitor internal 
controls to mitigate risks created by some key employees having 
incompatible access to computer system functions. The university also did 
not resolve a prior audit finding when it allowed its cashiers to share logon 
IDs. 15 

The university allowed some key employees, such as the heads of the finance, 
human resources and payroll, and admissions and records to have incompatible 
access to accounting systems without designing, documenting, or monitoring the 
effectiveness of mitigating controls. The employees who set up, modified, and 
monitored employee system access for the university could also make changes to 
their own security access rights. These employees could modify their access, 
perform unauthorized transactions, and change their access back without 
detection. The university did not develop any mitigating controls, such as review 
of security changes by another person, to detect inappropriate or unauthorized 
changes these employees could make to their own security access rights. This 
resulted in a high risk that error or fraud could occur without detection. 

In addition, the university allowed employees who performed cashiering duties to 
share logon IDs to access MnSCU's accounting system. Sharing logon IDs 
undermines good security because it limits management's ability to hold 
employees accountable for specific transactions, increasing the risk of theft or 
fraud. 



Finding 2 



15 Minnesota Office of the Legislative Auditor, Financial Audit Division Report 02-58, 
Metropolitan State University, issued September 6, 2002 (Finding 3). 
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Recommendations 

• The university's security approvers should not be allowed to 
change their own security access or develop mitigating 
controls to monitor the approvers ' access. 

• The university should ensure that employees do not share 
system access, or they should develop other controls to hold 
employees accountable. 



Metropolitan State University charged some students tuition rates and fees Fin din 
that were different from the amounts approved by the MnSCU Board of 6 
Trustees. 

The university did not have effective internal controls in place to ensure that it 
charged students the rates for some tuition and fees that the MnSCU Board of 
Trustees had authorized. 16 We compared the board approved rates and fees to the 
amounts in the university's tuition and fee rate tables used to charge students. 
Table 2 shows the discrepancies between the board's approved tuition and fee 
rates and those in the university's tuition and fee table, and the actual over (under) 
charges to students because of those errors. (Because students did not register for 
some of the incorrect tuition or fee types, not all of the discrepancies had a 
financial impact.) 



MnSCU Policy 5.11 - Tuition and Fees details that the Board of Trustees shall approve the 
tuition structure for all colleges and universities. 
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Table 2 
Tuition Rates and Fees 
Discrepancies between MnSCU Board of Trustees' Approved Amounts and 
Metropolitan State University's Tuition and Fee Rate Tables 



Tuition/Fee Type 


Terms 


Board 
Approved 
Amounts 


Tuition 
and Fee 

Table 
Amounts 


Actual Over 
(Under) 
Charge 


Online Undergraduate 
Internet Courses 


Summer 2008 

through 
Summer 2009 


$229 


$230 


$28,984 


Graduate Assistant - 
Online Graduate Internet 
Courses 


Summer 2009 

through 
Spring 2010 


$363 


$63 





Summer 2010 

through 
Spring 201 1 


$383.19 


$63 


($5,763) 


Graduate Internet 
Courses 


Summer 2008 

through 
Summer 2009 


$346 


$345 


($4,551) 


Undergraduate Tuition 
Rate for South Dakota 
Residents 


Summer 2008 

through 
opnng zuuy 


$187.10 


$197.53 1 


$1,596 


Fall 2010 
through 
Spring 2011 


$210.99 


$221. 42 1 


$125 


Special Course Fee (Art) 


Fall 2010 


$12.50 


$20 


$810 


Graduate Assistant - 
Minnesota Internet 
Courses 


Summer 2010 


$242 


$177.15 


($259) 


Fall 2010 and 
Spring 2011 


$255.45 


$187 


$0 


Undergraduate Nursing 
Program Tuition Rate for 
Wisconsin Residents 


Fall 2009 
through 
Summer 2010 


$237 


$182.36 


$0 


Fall 2010 
through 
Spring 2011 


$250.18 


194.06 


$0 



Note 1 - The university added the general required fees ($10.43 total per credit) to the tuition rate and also 
separately charged the students for the fees. 

Sources: MnSCU Board of Trustees' minutes and Metropolitan State University's tuition and fee rate 
tables. 



Effective controls could include a periodic verification that the rates used to 
determine tuition and fee charges were approved by the Board of Trustees and 
accurately entered into MnSCU' s registration system. 

Recommendations 

• The university should establish controls to ensure that it 
charges the tuition rates and fees approved by the MnSCU 
Board of Trustees. 



• To the extent possible, the university should adjust students ' 
accounts for past inaccurate tuition and fee charges. 
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Prior Systemic Finding Not Resolved: 17 Metropolitan State University did not pinrlincr A 
always accurately account for faculty and administrator leave benefits. ^ 

Metropolitan State University did not have effective controls to ensure it properly 
recorded leave earned or taken by employees. MnSCU's computerized system 
does not always accurately incorporate the leave provisions of the various 

1 8 

bargaining agreements. Errors in recording sick and vacation leave could result 
in employees receiving leave benefits that do not comply with applicable 
bargaining agreements. 

Metropolitan State University had the following errors in its leave records: 



• The university inaccurately recorded sick leave earned for 13 of 28 
employees we tested. 19 The university did not record any sick leave for 
some of these employees and recorded the wrong amount for others. For 
10 of the 13 exceptions, the university's errors related to leave earned by 
part-time faculty, primarily when they were working during the summer 
sessions. These errors resulted in 12 employees' leave balances being 
understated by a total of 239 hours and one employee's leave balance 
being overstated by 17 hours. 

• The university inaccurately recorded sick and vacation leave taken for 4 of 
28 employees we tested. The amount recorded in the payroll system 
differed from the amount approved on the leave slip. In two of the 
exceptions, the system showed 20 and 28 more hours of vacation, while a 
third exception showed 56 more hours of sick leave than approved on the 
leave slips. For the fourth exception, the university miscoded another 
employee's 56 hours of sick leave as vacation leave. 

In its response to this issue in our 2010 audit, the MnSCU system office stated 
that it had taken significant steps to improve the leave accounting processes for 
colleges and universities. One step the university took was to provide employees 
with monthly statements of leave earned and used. However, employees may not 
review the statements promptly or report discrepancies to university staff. 
Employees did not identify the errors found in our testing. 



17 Minnesota Office of the Legislative Auditor, Financial Audit Division, Report 10-29, Minnesota 
State Colleges and Universities, issued September 14, 2010 (Finding 4). 

18 MnSCU universities maintain leave records for administrators and faculty in MnSCU's State 
Colleges and Universities Personnel Payroll System. 

19 The 28 employees tested included full and part-time faculty, unclassified administrators, and 
Minnesota State University Association of Administrative and Service Faculty employees. 
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Recommendations 

• The university should develop effective controls to ensure it 
accurately accounts for faculty and administrator leave 
benefits. 

• The university should correct leave balances for those 
employees where we identified discrepancies. 

• The university should review summer leave accruals for all 
part-time faculty. 

• The MnSCU system office should continue to work with 
universities to address leave accounting problems and consider 
improvements in the computerized leave module of the 
personnel system. 



Finding g Metropolitan State University inaccurately compensated some employees. 

The university inaccurately paid 2 of the 31 faculty members we tested. The 
university underpaid one faculty member $14,150 because the human resources 
staff did not include four credits of curriculum development, omitted 1.4 duty 
days for curriculum coordination, and underpaid an independent assignment. The 
department also underpaid one faculty member $1,064 because of errors in 
recording overload credits and coordinator assignment duty days in fiscal year 
2009. 



The university had errors in compensating its faculty and did not accurately 
record assignments in its payroll system. MnSCU' s faculty contracts define the 
terms of faculty compensation. Typically, the university pays faculty based on the 
course credits taught or duty days worked. Although a faculty member may have 
an initial course schedule, the university may drop or add a course based on 
student enrollment. In addition, a faculty member's compensation could change if 
they have overload or special assignments, such as independent study or 
coordinator duties. Each university's academic department is responsible to report 
faculty assignments and any subsequent changes to their human resources 
departments. Human resources staff is responsible for ensuring that faculty 
assignments are accurately reflected in the university's payroll and personnel 
system. Inaccurate assignment data not only results in inaccurate compensation, 
but also inaccurate information for university planning and budgeting. 
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Recommendations 

• The university should review the assignments for the two 
underpaid faculty members and make any necessary salary 
adjustments. 

• The university should ensure that it accurately records faculty 
assignment information in its payroll system. 



Prior Finding Partially Resolved: 20 Metropolitan State University did not Finding 6 
verify the accuracy of its bookstore commission receipts. 

Metropolitan State University did not determine if it received the correct amount 
of commissions from the vendor who operated its bookstore. The university did 
not verify or complete a detailed analysis of the vendor's financial records to 
substantiate the gross sales amounts the vendor used as the basis for the 
commission payments. Instead, the university relied on the vendor's monthly 
summary of the bookstore's gross sales amounts. For the period July 2009 
through March 2011, the vendor paid commission to the university totaling 
approximately $842,000. The contract with the bookstore vendor allowed the 
university to review the vendor's financial records in order to verify the accuracy 
of its commission receipts. 

Recommendation 

• The university should ensure the accuracy of commission 
receipts it receives from the bookstore vendor. 



Metropolitan State University did not always retain adequate documentation Finding 7 
to support its personnel and payroll actions. 

Metropolitan State University did not always retain adequate documentation to 
support its personnel decisions, assignments, and assignment changes. The 
university did not have documentation to support the following personnel actions: 

• The university did not retain personnel action forms for seven employees 
to document new hires or changes in job status or assignment changes. In 
one case, Human Resources did not follow-up with the Provost's Office to 
ensure it received a personnel action form. 



Minnesota Office of the Legislative Auditor, Financial Audit Division Report 02-58, 
Metropolitan State University, issued September 6, 2002 (Finding 2). 
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• The university did not retain an appointment letter to document the annual 
assignment for one faculty member. 

• The university did not retain updated assignment forms or instructional 
change request forms for two faculty members to document changes to 
their assignments. 

• The university did not retain the invoice for one faculty member's paid 
independent study assignment. 

In regards to payroll, the university did not retain leave slips for 4 of 28 
employees tested. 

Minnesota Statutes require the university to maintain records necessary to provide 
full and accurate documentation of official activities. 21 Statutes further require 
that the chief administrative officer of each agency preserve the agency's records 
connected to the transaction of public business, including protecting these records 
from deterioration, mutilation, loss, or destruction. State policies reinforce this 
requirement. Without adequate supporting documentation, the university was 
unable to show that the personnel actions complied with applicable legal 
requirements. 

Recommendation 

• The university should ensure it retains sufficient documentation 
to support its payroll and personnel activities. 



j« q Prior Systemic Finding Partially Resolved: 22 Metropolitan State University 

o° did not sufficiently control employees' use of university-issued purchasing 

cards. 

Metropolitan State University allowed four employees to share the use of its 
purchasing card; however, MnSCU policy restricts the use of the purchasing card 
to only the authorized purchasing card holder. 23 The purchasing card was issued 
in the name of the university and the university employee responsible for 
purchasing. By allowing other employees to use the purchasing card, the 
university may not always be able to identify who used the purchasing card or 
ensure that the purchases were authorized and complied with purchasing 
requirements. From June 2008 through March 2011, the university used the 
purchasing card to pay for about $71,000 of costs. 



21 Minnesota Statutes 2009, 15.17, subd. 1 and subd. 2. 
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Minnesota Office of the Legislative Auditor, Financial Audit Division Report 10-29, Minnesota 



State Colleges and Universities, issued September 14, 2010 (Finding 6). 
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MnSCU policy 7.3.3 requires the cardholder to not allow anyone else to use the purchasing card 



or card account number. 
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In addition, the university did not have original, itemized receipts for 4 of the 23 
purchasing card purchases we tested. MnSCU procedure requires cardholders to 
obtain and retain original itemized receipts for all purchases. 24 Without the 
supporting documentation, the university was unable to show that these purchases 
(totaling $420) were allowable uses of the purchasing card. MnSCU' s policies 
and procedures for purchasing card purchases restrict the types of items that can 
be purchased and requires that those purchases comply with MnSCU' s other 
purchasing policies and procedures. 25 

Recommendation 



• The university should ensure that purchases made by 
employees with the university's purchasing card comply with 
purchasing card and other purchasing policies and 
procedures. 



Metropolitan State University did not properly delegate authority to some of Pi rifling O 
its employees to authorize contracts, purchase goods or services, and approve * 
invoices for payment. 

For the transactions we reviewed, Metropolitan State University allowed five 
employees to bind the university to legally enforceable obligations without the 
appropriate delegation of authority, as explained in the following bullets: 



Metropolitan State University allowed two employees to enter into 
contracts or make purchases that exceeded their delegated authorities. 
One of the employees entered into a contract for services totaling $61,319 
after amendments; however, the employee only had delegated authority up 
to $50,000. The other employee purchased supplies for the food service 
operations costing $1,121; however, the employee only had delegated 
authority up to $1,000. 

Metropolitan State University allowed an employee with no delegated 
authority to purchase books for the library totaling $1,551. The university 
allowed the same employee to make purchases for the library using the 
university's purchasing card number without formal delegated authority. 

Three employees were allowed to approve invoices for payment without 
delegated authority. 



24 MnSCU Procedure 7.3.3, Part 7. 

25 MnSCU Procedure 7.3.3 - Credit Cards. Part 6, lists items not allowed to be purchased with 
purchasing cards, including items for personal use, individual meals and other travel expenses, 
entertainment or recreation items, and alcoholic beverages. 
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• The university did not comply with the MnSCU procedure when it 
allowed an administrator to write-off accounts receivable without formal 
delegation of authority from the president. 26 

MnSCU procedure required a formal delegation of authority for employees to 
perform certain operations, including contracting, purchasing, and write offs of 
accounts receivable. 27 Each university president is accountable for assuring proper 
delegation of authority to employees of that institution. 

Recommendations 

• The university should document its delegation of authority to 
staff that enter into certain transactions, such as authorizing 
contracts, purchases, payments, and accounts receivable write- 
offs. 

• The university should establish controls to ensure that only 
staff with formal delegated authority perform contracting and 
purchasing functions, including authorizing payments and 
writing off accounts receivable. 



Finrlincy in Metropolitan State University did not properly process graduate assistant 
payroll transactions. 

During the period from July 2008 through March 2011, the university billed 
departments for the cost of graduate assistants' tuition reductions. However, 
MnSCU policy requires the university to process the graduate assistant tuition 
reduction transactions through the student payroll system. 28 By not processing 
these transactions through the student payroll system, the university did not 
determine whether taxes needed to be withheld or whether the university needed 
to report the tuition reduction as income to state and federal tax departments. 

Recommendations 



• The university should process graduate assistant payroll 
activity through the student payroll system, as required by 
MnSCU policy. 



MnSCU Procedure 7.6.2, Subpart G - Details that all write-offs of uncollectible accounts 
receivable require the approval of the president or designee. 

27 MnSCU Procedure 1A.2.2 - Delegation of Authority. 

28 MnSCU Policy 4.5, defines the graduate assistant positions and funding, and requires that the 
transactions be processed through the student payroll system. 
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• The university should review its graduate assistant payroll 
transactions to ensure compliance with state and federal tax 
laws. 

Metropolitan State University did not always properly process student Finding 11 
tuition waivers. 

The university did not always follow MnSCU policy when it waived tuition and 
fees for students. The university did not always obtain proper approval for student 
tuition waivers before processing them in the accounting system. The university 
did not have evidence of approval by the associate vice president for 7 out of 12 
student waivers we tested, totaling $15,341. Without proper authorization, there is 
no assurance that the waivers met the criteria for waiving tuition or fee charges. 

Waivers are high-risk transactions, because they reduce the university's revenue. 
During the period from July 2008 through March 2011, student waivers totaled 
$131,697. 

Recommendation 

• The university should document appropriate authorization for 
student tuition and fee waivers. 

Metropolitan State University did not accurately refund tuition and fees to Finding 12 
certain students. 

The university did not have adequate controls to ensure it accurately refunded 
tuition and fees to certain students. The university had errors in four out of seven 
tuition and fee refunds we tested, totaling $1,108. For example, the university 
under-refunded one student $395 and over-refunded another student $328 since 
the wrong number of days were used to determine the tuition refund amount. 

Refunds are high-risk transactions because determination of the refund amount 
requires manual calculations and knowledge of MnSCU' s refund criteria. The 
university made some errors because staff used the wrong refund schedules and 
others because staff included holidays as business days when determining the 
allowable refund period, which is not compliant with MnSCU policy. 30 



MnSCU Policy 5.12, Subpart D, shows the tuition and fee refund schedule for withdrawals from 
for-credit courses. 

30 MnSCU Policy 5.12, Subpart C, states that business days are defined as Monday through Friday 
(excluding posted holidays). 
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Recommendations 

• The university should accurately calculate tuition and fee 
refunds in accordance with MnSCU policy. 

• The university should review its tuition and fee refunds and 
adjust the students ' accounts for errors identified. 
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January 12, 2012 



Mr. James R. Nobles 

Legislative Auditor 

Office of the Legislative Auditor 

Centennial Office Building 

658 Cedar Street 

St. Paul, MN 55155 



Dear Mr. Nobles: 



Thank you for the opportunity to review and comment on your report that summarizes the results of 
Metropolitan State University's audit for the period July 1, 2008 through March 31, 2011. 

We appreciate the review process as we continually strive for quality improvements and enhancements 
in internal controls. 



As part of my commitment to continuous improvement in all aspects of our operations, I continue to 
place high emphasis on transparency in fiscal matters. In addition, as part of the university's 
commitment for continuous improvement, we continue to make special efforts to document procedures 
as well as to improve our internal controls. The observations and recommendations contained in the 
audit report will assist us on our journey for continuous improvement and strengthen fiscal operations 
and accountability. 

I would also like to comment that over the past few years the University has been and continues to be 
challenged with staff vacancy and turnover, both in Financial Management and in Human Resources 
Offices. The vacancy and turnover create significant challenges for management as well as places 
greater work load on the remaining staff. 



We wish to extend our sincere thanks to your field and management staff who took time to assess our 
operations. Please find listed below our responses to the findings, including remedies: 



Finding 1: 

Prior Systemic Finding Not Resolved: Metropolitan State University did not adequately assess its 
business risks or monitor the effectiveness of its internal controls. 

Response: 

Metropolitan State University partly agrees with this finding. The University takes seriously its fiduciary 
responsibilities as the custodian of tuition and state appropriation funds. The University complies with 
policies, procedures and guidelines established by Minnesota State Colleges and Universities Board of 
Trustees, including preparation of annual financial statements audited by independent auditors, and 
internal control reviews conducted by the Office of Internal Audit. Internal controls are documented and 
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updated annually in the Business Control Cycles established by Minnesota State Colleges and 
Universities. Administration of Metropolitan State University reviews each report issued by the Office of 
the Legislative Auditor regarding Minnesota State Colleges and Universities, to determine risks and 
impact on Metropolitan State University. 

The university appreciates the recommendation. As part of our commitment to continuous 
improvement in internal controls, we will continue to improve our document processes, while 
frequently reviewing the risks and monitoring functions related to our operations and compliance 
responsibilities. 

Responsible Individual(s): Primary - Ronald Beckstrom; secondary - Murtuza Siddiqui. 
Resolution Period: Fiscal Year 2012 - 13 



Finding 2: 

Metropolitan State University did not design, document or monitor internal controls to mitigate risks 
created by some key employees having incompatible access to computer system functions. The 
university also did not resolve a prior audit finding when it allowed its cashiers to share logon IDs. 

• The employees who set up, modified, and monitored employee system access for the 
university could also make changes to their own security access rights. These employees 
could modify their access, perform unauthorized transactions, and change their access back 
without detection. The university did not develop any mitigating controls, such as review of 
security changes by another person, to detect inappropriate or unauthorized changes these 
employees could make to their own security access rights. 

Response: 

Metropolitan State University partly agrees with this finding. The University monitors access to 
computer systems at least annually during security recertification, and is diligent in developing 
monitoring and/or detective controls when the system(s) indicate an incompatibility exists. Mitigating 
controls are also monitored and reviewed by the Office of Internal Audit to ensure that the mitigating 
controls are being followed. The system used by both Financial Management and HR/Payroll security 
access rights was designed and is maintained by the MnSCU System Office Information Technology unit. 
In addition, because the System Office IT unit maintains the security access rights system used by all 
MnSCU institutions, IT works with the System Office's Human Resources division to monitor individual 
campus access rights to ensure that everyone , including those with the authority to set up, modify, and 
monitor other employees' access rights, has the appropriate authorization. 

The University does agree that there is improvement possible in internal controls that allow security 
managers to grant themselves access to functions within their functional areas. Most approval managers 
are responsible for their own areas, which makes having alternate approval managers difficult. While 
approval managers can make changes to their access without notification to others, the transactions are 
logged in the computer systems. The University has had discussions with the Office of Internal Audit and 
will encourage MnSCU to make changes to the computer systems to generate notifications to the 
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Institution Security Manager and/or Administration to notify when a security manager changes his or 
her access. 

• The university allowed employees who performed cashiering duties to share logon IDs to 
access MnSCU's accounting system. 



Response: 

Metropolitan State University agrees with the finding that cashiering employees share a logon to the 
ISRS system; however, the University believes that mitigating and detective controls in place reduce the 
risk of loss. The University has a single cash register and cash drawer, the volume of transactions does 
not justify a second cash register and drawer, and requiring separate logons each time a different 
employee is performing cashiering duties using a single cash drawer is not viable. As mitigating controls, 
the University does daily reconciliations of the cash drawer and deposit, and the transactions are also 
reconciled daily to the local bank account. The University is also implementing having a manager sign off 
on the daily cash reconciliation at the end of the business day, which approval would be filed as part of 
the daily cash session. 



Responsible Individual(s): Ronald Beckstrom 
Resolution Period: End of the FY 2012 



Finding 3: 

Metropolitan State University charged some students tuition rates and fees that were different from 
the amounts approved by the MnSCU Board of Trustees. 

Response: 

The University agrees with this finding. The errors noted occurred during turnover in the Financial 
Management office functions over tuition table entry. We have put processes in place to have tuition 
and fee tables reviewed by a second employee after entry into the ISRS system, to compare tuition and 
fees entered with rates approved by the Board of Trustees. In addition, it should be noted that there 
was an issue with rounding of the numbers, in which the rates submitted to the Trustees were rounded 
down in the Board of Trustee minutes, but were rounded up by the University in the tuition tables. In 
the future, we will ensure consistency. 

Responsible Individual(s): Primary - Miliite Gebrimichael; Secondary - Ronald Beckstrom 
Resolution Period: Completed 



Finding 4: 

Prior Systemic Finding Not Resolved: Metropolitan State University did not always accurately account 
for faculty and administrator leave benefits. 
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Response: 

The University agrees with the finding. In addition to forwarding all leave balances to faculty members 
and administrators, on a monthly basis, when the Office of Human Resources prepares to separate 
(retirement, resignation, termination, etc.) a faculty member or an administrator, the Office of Human 
Resources also reviews the faculty member's/administrator's leave balances to ensure it is accurate so 
that the university complies with severance and vacation pay out provisions of the applicable collective 
bargaining or personnel plan. 
Responsible Individual(s): Stephanie Miller 
Resolution: Currently underway 



Finding 5 

Metropolitan State University inaccurately compensated some employees. 

Response: 

We do not fully concur with the stated amounts; however, we do take accuracy of compensation very 
seriously. As part of due diligence, we will continue to work very closely with Academic Division to 
ensure accuracy of information. Further, we are committed to reviewing the stated amounts to reach 
resolution. 

Responsible Individual(s): Primary - Stephanie Miller; Secondary - Murtuza Siddiqui 
Resolution: Currently underway 



Finding 6 

Prior Finding Partially Resolved: Metropolitan State University did not verify the accuracy of its 
bookstore commission reports. 

Response: 

The University agrees with this finding. Commission reports are provided monthly to the manager 
responsible for administration of the contract with the bookstore vendor. These reports are then 
provided to Financial Management along with the monthly commission check as documentation for the 
receipts. 

However, the monthly point-of-sale report had not been received by the University's cognizant 
accounting personnel due to a change in email addresses for the Financial Management office, and this 
was not investigated nor corrected. Upon notification of this finding, the University put into place 
procedures for monthly reconciliation of the point-of-sale report with the commission payment. The 
reconciliation is being provided monthly to the Accounts Receivable manager, and quarterly to the 
Associate Vice President for Financial Management. 

Responsible Individual(s): Primary - Miliite Gebrimichael; Secondary - Ronald Beckstrom 
Resolution: Complete 
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Finding 7 

Metropolitan State University did not always retain adequate documentation to support its personnel 
and payroll actions. 

Response: 

The University concurs with the finding. We are reviewing our current processes and will ensure that 
proper documentation is retained. It should be noted however, that the university has undergone 
staffing changes, particularly in Human Resources. 

Responsible Individual(s): Stephanie Miller 
Resolution: On-going 



Finding 8 

Prior Systemic Finding Partially Resolved: Metropolitan State University did not sufficiently control 
employees' use of university-issued purchasing cards. 

Response: 

The University agrees with this finding. The University currently has only one university-issued 
purchasing card, and use of the purchasing card by other than the card holder is considered a poor 
practice in addition to an internal control deficiency. The charges to the card are monitored closely to 
ensure that charges are appropriate, and in the case where the card was used inappropriately, use of 
the card by the employee was immediately terminated. 

The University is working with the Minnesota State Colleges and Universities Campus Service 
Cooperative to expand the purchasing card program at the University, to ensure that cards will be issued 
to newly-designated cardholders and may be used only by the cardholders and authorized users. 

Responsible Individual(s): Ronald Beckstrom 
Resolution: Pending 



Finding 9 

Metropolitan State University did not properly delegate authority to some of its employees to 
authorize contracts, purchase goods or services, and approve invoices for payment. 

Response: 

The University agrees with this finding. The University has implemented measures to comply with 
purchasing and contracting policies and procedures. Delegations of authority are reviewed and 
compared to purchase requisitions and invoices when received, to ensure that the approving person has 
the authority to bind the University. This also extends to contracts in which amendments may exceed 
the approving officials delegation of authority, and approval is sought by the manager with appropriate 
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authority. The Financial Management Office works periodically with the President's Office to verify 
existence of the delegation of authority form on file. 

The University has also amended the delegation of authority for the Vice President of Administrative 
Affairs, and the Associate Vice President for Financial Management, to grant authority to write-off 
uncollectible accounts receivable. 

Responsible Individual(s): Primary - Purchasing & Accounts Payable; Secondary: Ronald Beckstrom 
Resolution: Complete and on-going 



Finding 10 

Metropolitan State University did not properly process graduate assistant payroll transactions. 

Response: 

The University does not fully agree with this finding. The University has worked with MnSCU Tax Services 
Unit to review the Procedures for Taxation of Graduate Student Tuition Reductions, as published on the 
MnSCU Tax Services web site. The taxable status of graduate assistant tuition reductions is determined 
by whether the tuition reduction requires performance of services to qualify for the tuition reduction. 
The hours worked by graduate assistants are processed through the payroll system, but the tuition 
reductions are processed through third - party if there is no service requirement. This process appears 
to be consistent with MnSCU Tax Services Unit procedures. 

Responsible Individual(s): Ronald Beckstrom 
Resolution: On-going 



Finding 11 

Metropolitan State University did not always properly process student tuition waivers. 

Response: 

The University agrees with this finding. Student tuition waivers are submitted to the Financial 
Management office for processing and approval by the Associate Vice President for Financial 
Management. Approval for tuition waivers had not been consistently enforced due to turnover in the 
Financial Management office. The University will ensure that all student tuition waivers are properly 
reviewed and approved, and documentation maintained in the Financial Management office. 
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Finding 12 

Metropolitan State University did not accurately refund tuition and fees to certain students. 



Response: 

The University agrees with this finding. Errors noted in the report occurred during a period of staff 
turnover and the new staff calculating refunds was not fully trained in the application of MnSCU refund 
policies. Staff in the Registrar's office that process refund transactions have been thoroughly trained in 
application of the MnSCU policy regarding refunds. The Registrar's office will work with the Financial 
Management office to make appropriate adjustments to students' accounts for errors identified. 

Responsible Individual(s): Ronald Beckstrom and Andrew Melendres. 
Resoultion: Accounts to be adjusted by the end of FY 2012. 



Sue K. Hammersmith, Ph.D 
President 

cc: Mr. Murtuza Siddiqui, CFO/Vice President of Administrative Affairs 
Ms. Beth Buse, Executive Director, Internal Auditing 
Ms. Laura King, Vice Chancellor for Finance and Administration 
Mr. Ron Beckstrom, Associate Vice President, Financial Management 
Ms. Stephanie Miller, Director, Human Resources 



Respectfully, 
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